Kerberos : switch MIT to Heimdal

Métriques du dépôt

Stars: (44 809 étoiles)
Métriques de merge PR: (Merge moyen 7j 18h) (834 PRs mergées en 30 j)

Description

Apache Airflow version

2.3.4

What happened

Hi,

In my infrastructure, we are using Kerberos Heimdal for our keytabs. I can see that airflow seems to be using MIT...

I managed to switch to Heimdal by customizing the image : replacing krb5 packages with heimdal-clients.

ADDITIONAL_RUNTIME_APT_DEPS=""
RUNTIME_APT_DEPS="apt-transport-https apt-utils ca-certificates curl dumb-init freetds-bin gosu heimdal-clients ldap-utils libffi7 libldap-2.4-2 libsasl2-2 libsasl2-modules libssl1.1 locales lsb-release netcat openssh-client python3-selinux rsync sasl2-bin sqlite3 sudo unixodbc"

But the kinit command used by Airflow seems to be specific with MIT :

airflow@7e253512ada7:/opt/airflow$ kinit -f -a -r 5m -k -t /opt/airflow/security/airflow.service.keytab -c /tmp/airflow_krb5_ccache airflow/dtl-airflowdocker01-d01.dc05@DC05 
5m@DC05's Password: 
kinit: krb5_get_init_creds: Client (5m@DC05) unknown

the "-r 5m" seems to be the problem. Adding --renewable or deleting -r 5m seems to fix this issue. But how to "fix" this properly ?

Regards,

What you think should happen instead

Either :

find a way to switch to Heimdal properly
maybe an option to customize args to kinit
...

How to reproduce

Use kerberos with Heimdal.

Operating System

Debian (Docker)

Versions of Apache Airflow Providers

airflow-exporter==1.5.3
apache-airflow==2.3.4
apache-airflow-providers-amazon==5.0.0
apache-airflow-providers-apache-cassandra==3.0.0
apache-airflow-providers-apache-hdfs==3.1.0
apache-airflow-providers-celery==3.0.0
apache-airflow-providers-cncf-kubernetes==4.3.0
apache-airflow-providers-common-sql==1.1.0
apache-airflow-providers-docker==3.1.0
apache-airflow-providers-elasticsearch==4.2.0
apache-airflow-providers-ftp==3.1.0
apache-airflow-providers-google==8.3.0
apache-airflow-providers-grpc==3.0.0
apache-airflow-providers-hashicorp==3.1.0
apache-airflow-providers-http==4.0.0
apache-airflow-providers-imap==3.0.0
apache-airflow-providers-microsoft-azure==4.2.0
apache-airflow-providers-mysql==3.2.0
apache-airflow-providers-odbc==3.1.1
apache-airflow-providers-postgres==5.2.0
apache-airflow-providers-redis==3.0.0
apache-airflow-providers-sendgrid==3.0.0
apache-airflow-providers-sftp==4.0.0
apache-airflow-providers-slack==5.1.0
apache-airflow-providers-sqlite==3.2.0
apache-airflow-providers-ssh==3.1.0
google-cloud-orchestration-airflow==1.4.1

Deployment

Other Docker-based deployment

Deployment details

No response

Anything else